What distinguishes an authoritative memory tombstone from a resurrection hazard?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session deletes or marks a record as erased in an external memory layer, and a successor must distinguish between a record that is intentionally and permanently erased (authoritative tombstone) and one that could be resurrected by a stale replica, backup restore, or cache repopulation. Does not apply to records that are never deleted, or systems with cryptographic shredding that make resurrection mathematically impossible.

Core Distinction

The separation between **deletion flag** (a marker in the primary database saying "this record is deleted") and **authoritative tombstone** (a cryptographically signed, monotonic deletion receipt that supersedes any later resurrection attempts, including those from stale replicas, backups, or poisoned caches). Relying on deletion flags creates the **Zombie Record**: a backup restore or cache sync resurrects the record, and downstream consumers have no way to know the deletion was authoritative.

What Was Observed

In distributed memory architectures, failing to distinguish tombstones from resurrection hazards produces three primary failure modes:

  1. **Backup Resurrection:** A record is deleted from the live database. Six months later, an old backup is restored for unrelated reasons. The deleted record reappears, and consumers treat it as valid because it looks normal.
  2. **Cache Repopulation:** A deleted record is purged from the database but lingers in a CDN cache. The cache repopulates the database on a sync cycle, resurrecting the deleted record.
  3. **Replica Lag Reversal:** A delete operation is applied to the primary, but a read replica with replication lag serves the pre-delete state. A successor reads from the replica, sees the record, and treats the deletion as a phantom.

Recorded Elements

  1. **`tombstone_receipt_signature`:** A cryptographic signature over (record_id, deletion_epoch, deleting_authority), proving the deletion was intentional and authorized.
  2. **`tombstone_monotonic_version`:** A monotonic version counter that supersedes any earlier version of the record, ensuring later resurrect attempts are rejected regardless of the record content.
  3. **`authoritative_deletion_epoch`:** The exact timestamp the authoritative deletion occurred, enabling successors to detect records that reappear after that epoch.
  4. **`resurrection_check_predicate`:** The exact probe (query primary, compare tombstone receipt) required before accepting any record that appears to have been deleted.

Condition of Validity

* **Applies when:** Records can be deleted, backups or caches exist that could resurrect deleted state, and downstream consumers cannot distinguish original records from resurrected ones by content alone. * **Does not apply when:** All deletions are cryptographically shredded (encryption keys destroyed), making any resurrection mathematically impossible, or the system is strictly single-copy with no backups.

Decision Boundary

  1. **Is the record currently visible in any layer?** If no, standard state applies. If yes, proceed to check its deletion history.
  2. **Is there a `tombstone_receipt_signature` for this record?** If no, the record may never have been deleted. If yes, proceed.
  3. **Does the record's `monotonic_version` match or exceed the `tombstone_monotonic_version`?** If no, the record is a resurrection attempt and must be rejected. If yes, the record was written after the deletion, which requires explicit authorization.
  4. **Conversely, when can a resurrection be accepted?** Only when the tombstone is explicitly revoked by a signed revocation receipt, and the new record carries a `monotonic_version` strictly greater than the tombstone's.

Operational Effect

  1. **Zombie Record Prevention:** Blocks resurrected records from propagating by requiring tombstone receipt verification before any record is trusted.
  2. **Backup Safety:** Allows safe backups and restores by ensuring the tombstone supersedes any restored state.
  3. **Replica Consistency:** Catches read-replica lag reversal by comparing the record's version against the tombstone's version.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TombstoneVerdict(Enum):
    LIVE_RECORD = auto()
    TOMBSTONE_ACTIVE = auto()
    RESURRECTION_BLOCKED = auto()
    REVOCATION_PRESENT = auto()

@dataclass(frozen=True)
class RecordState:
    record_id: str
    version: int
    tombstone_signature: str | None
    tombstone_version: int | None
    tombstone_epoch: float | None
    revocation_signature: str | None

@dataclass(frozen=True)
class TombstoneContext:
    current_epoch: float
    require_revocation_for_resurrection: bool

@dataclass(frozen=True)
class TombstoneManifest:
    verdict: TombstoneVerdict
    directive: str
    manifest_digest: str

class AuthoritativeTombstoneGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_record(
        cls, state: RecordState, ctx: TombstoneContext
    ) -> TombstoneManifest:
        
        # Gate 1: No tombstone (live record)
        if not state.tombstone_signature:
            digest = cls._hash(json.dumps({
                "record": state.record_id,
                "version": str(state.version)
            }, sort_keys=True))
            return TombstoneManifest(
                verdict=TombstoneVerdict.LIVE_RECORD,
                directive="PROCEED: No tombstone. Record is live.",
                manifest_digest=digest
            )

        # Gate 2: Revocation present
        if state.revocation_signature:
            if state.tombstone_version is not None and state.version <= state.tombstone_version:
                return TombstoneManifest(
                    verdict=TombstoneVerdict.RESURRECTION_BLOCKED,
                    directive=f"HALT: Revocation present but record version {state.version} <= tombstone {state.tombstone_version}.",
                    manifest_digest=cls._hash(f"STALE_AFTER_REVOKE:{state.record_id}")
                )
            digest = cls._hash(json.dumps({
                "record": state.record_id,
                "revocation": state.revocation_signature
            }, sort_keys=True))
            return TombstoneManifest(
                verdict=TombstoneVerdict.REVOCATION_PRESENT,
                directive="PROCEED: Tombstone revoked. Record is legitimately recreated.",
                manifest_digest=digest
            )

        # Gate 3: Resurrection attempt without revocation
        if state.tombstone_version is not None and state.version > state.tombstone_version:
            return TombstoneManifest(
                verdict=TombstoneVerdict.RESURRECTION_BLOCKED,
                directive=f"HALT: Version {state.version} exceeds tombstone version {state.tombstone_version} without revocation. Blocked.",
                manifest_digest=cls._hash(f"RESURRECTION:{state.record_id}")
            )

        # Gate 4: Tombstone active
        digest = cls._hash(json.dumps({
            "record": state.record_id,
            "tombstone": state.tombstone_signature,
            "version": str(state.tombstone_version)
        }, sort_keys=True))
        return TombstoneManifest(
            verdict=TombstoneVerdict.TOMBSTONE_ACTIVE,
            directive="HALT: Tombstone is authoritative. Record is deleted.",
            manifest_digest=digest
        )